Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Daily Game News
v2.0.0自动抓取并分类多平台每日游戏资讯，生成格式化报告发送飞书并存档为Word和文本文件。
⭐ 0· 328·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description = crawl multi‑site game news and produce/send reports, and the repository contains multiple crawler scripts and docx/report generation code which fits that purpose. However SKILL.md and README say the skill will send formatted reports via Feishu, yet no required environment variables, primary credential, or code path are declared to hold Feishu webhook/app credentials. That mismatch (advertised push capability with no declared credentials) is an incoherence.
Instruction Scope
Runtime instructions reference reading a fixed config (/home/admin/.openclaw/workspace/configs/news-crawler-config.json), reading/writing reports and logs under /home/admin/.openclaw/workspace, and optionally installing a cron job. The included scripts perform many subprocess calls (curl, uv run, calling local scripts), call external endpoints (e.g., r.jina.ai), and invoke other local skill paths (../../searxng/scripts/...). While these actions are expected for a crawler, they broaden scope (network requests to third-party services, shell execution) and the SKILL.md gives open-ended guidance (edit crontab, run uv run) that could modify scheduled tasks.
Install Mechanism
There is no install spec (instruction-only install), so nothing is downloaded automatically by the registry. All code is bundled in the skill. This lowers install-time supply-chain risk, but the bundled code itself runs subprocesses and makes outbound network calls at runtime.
Credentials
The skill declares no required env vars, but the code expects/uses external services: it calls r.jina.ai, attempts to use SearXNG (with SEARXNG_URL set when invoking subprocesses), and promises Feishu push delivery (which normally requires tokens/webhooks). The absence of declared Feishu credentials or other auth variables is disproportionate to the claimed 'send to Feishu' behavior and may mean credentials are expected to live in the configuration file or elsewhere — you should inspect the config path before use.
Persistence & Privilege
always:false (good). The README/SKILL.md show commands to install a cron job (crontab /.../crontab.txt) which would persist daily execution if the user runs it; the skill does not request to be force-enabled or modify other skills. Persisting a cron job is user‑initiated here, so privilege is limited but worth noting.
What to consider before installing
What to check before installing or running this skill:
- Inspect the config file at /home/admin/.openclaw/workspace/configs/news-crawler-config.json before running: the code reads that file and it may contain URLs or credentials. Do not run the skill until you understand what is in that file.
- Feishu push mismatch: SKILL.md/README say reports are sent to Feishu, but the package does not declare any Feishu tokens or webhook env vars. Determine where you must put your Feishu credentials (likely in the config file) and ensure they are safe.
- Network and subprocess risk: the scripts call curl, call external services (r.jina.ai/jina.ai), run 'uv run' and run other local scripts (searxng path). If you cannot trust those external endpoints, run the skill in an isolated/test environment first.
- Cron change is manual: the README suggests installing a cron job. Only add the cron entry if you trust the code and have reviewed the scheduled command.
- Review sending code: search the codebase for any HTTP POST/requests that transmit data (especially to external endpoints) and verify exactly what is sent (reports, system paths, config contents). Confirm no sensitive tokens are transmitted inadvertently.
- Run manually first: execute the crawler in a sandbox or VM and observe outbound connections, files created under /home/admin/.openclaw/workspace/reports and logs, and check for failures that may indicate missing dependencies or expected local services (SearXNG).
- If you need this skill but want least privilege: remove or blank any push/webhook config until you explicitly provide a Feishu webhook, and avoid installing the cron until after testing.Like a lobster shell, security has layers — review code before you run it.
chinesevk970vcxfp74cg1ex1r7mrks1w182haz5crawlervk970vcxfp74cg1ex1r7mrks1w182haz5gamevk970vcxfp74cg1ex1r7mrks1w182haz5latestvk970vcxfp74cg1ex1r7mrks1w182haz5newsvk970vcxfp74cg1ex1r7mrks1w182haz5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.